ISO 27001 Readiness Check
Run a gap check against elements commonly expected for ISO 27001, from scope and risk assessment to controls, internal audit and management review. Not a certification audit.
- Free
- No sign-up to try
- Works as you type
Answer for the part of the organisation you'd put in scope. This is a gap check against commonly expected elements, not a certification audit or a sign that you meet the standard.
0 of 16 answered
Answer the questions to see your score by area as you go.
Answer at least 13 of 16 questions to save your results as a Room.
How it works
How the ISO 27001 Readiness Check works
- 1
Answer the questions
Pick the answer closest to where you are today. It takes a few minutes.
- 2
See your score
Your score by area appears as you answer, with the weakest areas first.
- 3
Save your results
Create a Room with your scores, next steps and an adviser to talk them through.
Worked example
What it makes
16 questions across 4 areas. Each answer scores 0 to 3; an area's score is its points as a share of the most it could get.
Scope and leadership
- Is the scope of your information security management system defined?
- How involved is leadership?
- Is there an information security policy?
Risk management
- Do you have a list of information assets and their owners?
- Is there a written method for assessing risks?
- Have risks been assessed and treatments decided?
Policies and controls
- How are access rights granted, reviewed and removed?
- How is suppliers' security handled?
- How are security incidents handled?
Monitoring and improvement
- Do you have security objectives, and do you measure progress?
- Have you run an internal audit of your security management?
- Does leadership review how the security system is performing?
Results bands: Not ready (0+), Getting there (40+), Mostly ready (70+), Ready (90+). A self-assessment from your own answers: a starting point for a conversation, not an audit, certification or professional advice.
Who it's for
Who uses it
Security and IT leads
Estimate how far you are from a certification audit.
Founders
Understand the work before committing to certification.
Consultants
Start a gap analysis with a client's own view.
Good to know
What to consider
- A readiness self-check, not a certification audit or a sign that you meet the standard. Only an accredited certification body can certify.
- It covers commonly expected elements, not every requirement or control in the standard; read the standard itself for those.
Questions
About the ISO 27001 Readiness Check
Does it list every ISO 27001 control?
No. It asks about the management system and the kinds of controls most organisations need to show. Use the standard and its control set for a full gap analysis.
Is this an audit or a certification?
No. It scores your own answers against a written rubric to show where you stand and what to do next. Use it to start a conversation, not as an audit, certification or professional advice.
Make your results now
Free, no sign-up to try. It becomes a Room you can edit, publish and share.
Create my resultsRelated
Related tools
- SOC 2 Readiness CheckFind the gaps to close before a SOC 2 audit: scope and policies, access and change control, monitoring, vendors and the evidence an auditor will ask for. Not an audit.
- Cybersecurity Self-AssessmentCheck the basic security controls a small team should have, such as sign-in, updates, backups, devices and staff awareness, and get the next steps for each gap.
- Risk Register Setup ChecklistMake a checklist for setting up and running a risk register: agree the scales, identify and rate risks, give each an owner and response, and review it regularly.